|Previous Section||Back to Table of Contents||Lords Hansard Home Page|
The Solicitor-General (Lord Falconer of Thoroton): My Lords, this has been an interesting and exceptionally well-informed debate, given the complex nature of the subject that we have been debating. I pay a special tribute to the speech of the noble Baroness, Lady Nicholson of Winterbourne, which showed her long experience of the matter in issue. The Government genuinely welcome all the contributions that have been made, and the spirit in which they have been made.
As my noble friend Lord Williams of Mostyn said in his introductory remarks, the Government are open to suggestions for improving the Bill. We shall look carefully at the suggestions that have been made today to see whether any amendments need to be made to deal with the concerns that have been expressed. Any amendments must, of course, be consistent with the directive's requirements and reflect the Government's general approach to proportionate regulation.
In his introductory remarks my noble friend Lord Williams of Mostyn referred to the Human Rights Bill. The noble Baroness, Lady Nicholson, and the noble Lord, Lord Wakeham, also referred to it. My noble friend saw this measure as a sister measure to the Bill. Another related measure, as has been pointed out, which the Government intend to bring forward before too long will be the legislation on freedom of information.
The Bill has received a broad welcome, in principle, from your Lordships. No one has questioned the principle behind the Bill. That principle, which underlay the Data Protection Act 1984, is that proper rules should be laid down for the processing of personal data, and that people should generally know what information is being processed.
When processing information, data processors should be obliged to comply with the data processing principles set out in the Bill. Those principles include processing personal data fairly and lawfully. Those are worthwhile aims to which everyone would subscribe. The difficulties involved in a measure such as this, which have in effect been identified by everyone, relate to trying to find a balance between, for example, what burden should be placed on corporate, charitable and government compliance; a balance as to what exemptions to provide from the scheme; and a balance on how to preserve the freedom of the press. The fulcrum of the debate has revolved around those three matters today.
I shall deal with some of the points that have been raised. I shall not go in detail through all the points that have been mentioned. That is a pleasure in store for us when we reach the Moses Room, I hope. I shall deal with the important principles that have been raised. The first relates to cost. The noble Viscount, Lord Astor, said that one of the themes that he would be pursuing throughout the debate on this matter on behalf of his party would be the burden to be placed upon industry in complying with the Bill. We have seen the estimated costs for start up and compliance with the Bill's provisions. As my noble friend Lord Williams of Mostyn said, they are no more than guesstimates.
A balance must be struck between the size of the burden that is put on industry and the right of people to know what is happening in relation to the processing of personal data. Where the balance is struck depends largely on the extent to which one imposes burdens in respect of personal manual files. Reference was made to the fact that the Data Protection Registrar wonders about the extent to which unstructured files will be exempt from the Act. We must debate that issue further at a later stage. However, the less structured the files which are covered by the provisions of the Bill the greater the cost to industry to comply. That balance must be struck and the Government will listen with interest to all comments made during the debate.
The noble Viscount, Lord Astor, went on to ask why the definition of data processing is so wide. He asked why it is not defined by reference to the data subject, as in the 1984 Act. The answer is that according to the directive to which we are giving effect it cannot be so limited. The noble Viscount raised concerns about insufficient protection for intellectual property. He will see that under Clause 8(5) trade secrets are a reason for refusing to give the information to which he referred.
The noble Viscount was also anxious about whether the provision could be used as a base to obtain information which would enable the commission of crime such as fraud. Clause 28(4) gives the Secretary of State the power to grant exemptions in order to avoid the commission of crime and to assist in its detection. That provision could be used if such a problem arose.
The noble Viscount described the Bill as being too prescriptive. In order to avoid a proper debate, he sensibly gave no examples. Unlike the Human Rights Bill, the Data Protection Bill tries to lay down a detailed code. It must do so under the terms of the directive. That is an appropriate and sensible way of dealing with the Bill without saying that it cannot be improved without sensible amendments. On the other hand, the Human Rights Bill intends to lay down general principles. It is more sensible that that aim is achieved in a shorter, less detailed Bill. It attempts to inform the whole of our law with a series of principles rather than seeking to lay down a code which particular individuals can use in order to protect themselves in relation to personal data and its use.
Perhaps I may move from the, "it's too heavy" line, used by the noble Viscount, Lord Astor, to the, "there are too many exemptions" line, adopted by a number of other noble Lords. The noble Lord, Lord Wakeham, eloquently expressed the "sensibleness" of press exemption. No one could have expressed the arguments in favour more eloquently. The only criticism that has been made during the debate came from my noble friend Lady Turner who expressed concern about the public interest exemption. Without wearying your Lordships with reference to detail, perhaps I may indicate the requirements of the clause before the exemption applies. Three rules must be complied with. First, the processing must be undertaken for journalistic, literary or artistic material. Secondly, the person undertaking the processing must reasonably believe, having regard in particular to the special importance of freedom of expression, that publication would be in the public interest. Thirdly, he must reasonably believe that in all the circumstances compliance with the provision in question is incompatible with journalism. I draw attention to the phrase "reasonably believe, having regard to the special importance of freedom of expression". In my view, in such circumstances "public interest" does not mean that the public are interested. It means something wider than that; namely, that there is a public interest having regard to the special importance of freedom of expression, but in relation to a particular story the press should be free to express it. I hope that that explanation goes some way to allay my noble friend's fears.
Three other issues were referred to. First, enforced subject access means someone compelling someone else to use his rights in order to obtain information pursuant to his rights under the data protection provisions. The Data Protection Registrar has indicated that she believes such an activity to be extremely bad. The Government, in their White Paper, stated that they would do something about that because they, too, believed it to be
Secondly, there is nothing in the Bill to deal with data matching. I emphasise that the first data protection principle provided in the Bill is that data should be used fairly and lawfully. We believe that that will deal with data matching to a large extent. Moreover, whenever data matching has been permitted it has been explicitly by statute. Although we shall give anxious consideration as to whether anything else needs to be done in relation to data matching, we believe that to a large extent the matter is dealt with under the existing Act.
Finally, it was said that close circuit TV was not dealt with in the Bill. We do not believe that it is necessary to do so. It is a form of data processing which in certain circumstances will contain personal data on individuals. In those circumstances, it is covered by the Bill.
Important points that we must consider were made about the insurance industry and the extent to which the Bill could be used to deal with or perpetuate insurance fraud. It is difficult to believe that anyone would regard it as possible or sensible to enter into an insurance policy as the insured, but at the same time refuse consent in any meaningful way to the investigation of an insurance claim. I believe that everyone will agree that if a claim is made under a policy the insurer is entitled to investigate it. Moreover, such a requirement is on the face of most insurance policies. No sensible person would regard that as an unfair or unreasonable consent to give. However, the appropriate course to take in relation to those questions about insurance is that we shall consider them and write to noble Lords.
There is a difference in relation to employees who give consent to their details being given to countries which do not have the same data protection rules as we do. That will require further consideration, but one can see that in those circumstances one would more readily give an unreal consent than one would in relation to an insurance policy. However, perhaps I may make arrangements for a letter to be written to deal with that point.
I hope that I have dealt with the main and important points in relation to the Bill. The introduction to Parliament of the Data Protection Bill can be regarded as the beginning of the end of a very long process. That process started as long ago as 1990 when the Data Protection Directive was first brought forward by the European Commission. There followed a long period of negotiations leading to the adoption of the directive by the member states of the European Parliament on 24th October 1995. The subsequent period has been taken up by consultation about the implementation of the directive within the United Kingdom and preparation, in the light of responses to that consultation, of the Bill which your Lordships have before you.
Although this whole process may be drawing to an end, we have a long way to go yet. In some senses, getting the Bill through Parliament is only the first stage. Even when the Bill is passed, as I hope it will be, much will remain to be done. It has been pointed out that the Bill provides a large number of powers to be made in
We also need to ensure that all those affected by the Bill understand its effects for them. Data subjects will need to know what are their new rights and data controllers will need to know what are their new responsibilities. That suggests the need for guidance of some kind.
Each year in her annual report the Data Protection Registrar includes some information about awareness of the Data Protection Act 1984 by data users and subjects. Her most recent report for 1997 stated, if I have read it properly, that awareness of the legislation increased to its highest level in the period covered by the report. That is a very welcome finding. We must ensure that when the Bill becomes law, we build on the already high awareness of the 1984 Act and make sure that all those affected become aware of their new responsibilities and rights under the Bill. In that way, we shall have taken an important step towards ensuring that as we venture further into the information age, we do so within an effective legislative framework for the protection of information about you and me and all our citizens which will last well into the 21st century.
Back to Table of Contents
Lords Hansard Home Page